What is the difference between the 'Collected Entries' in the UNSECURED view and the entries in the (NETIQKB30995)

goal
What is the difference between the 'Collected Entries' in the UNSECURED view and the entries in the REJECTED view?

fact
VigilEnt Security Agent for iSeries 5.4/7.0

fix
Location of Collected Entries is controlled by the value used on each Exit Point in the Collection field.

• UNSECURED entries are those that would fail due to having no rule in place that would have allowed them to go through.

• REJECTED entries are those that would fail because there is a rule in place to fail the transaction.

If the Exit Point, Collection field is set to *ALL, entries that fail would be in both the UNSECURED list and the REJECTED list. In other words, UNSECURED is a subset of the REJECTED view in this scenario.  This distinction could be used to determine the reason it would fail.  If *REJECT (or REJECTED) is used for the Collection value on the Exit Point, all entries will be written to that view, regardless of whether there is a rule governing the transaction or not.  ALLOWED Collected Entries are those that already have rules in place for them.

Formerly known as NETIQKB30995